There are many business environments in which access to certain areas or certain information is restricted to people who have authorization for such access. The financial services industry, particularly in banking, is one area where such limited access is crucial. Access to financial records is typically restricted to the individuals or businesses to whom the records relate and to the authorized personnel of the institutions who maintain those records. Any person wishing to access a financial record must typically undergo an authentication procedure to prove that that person does, in fact, have authority to review the record.
In the banking industry, for example, a person wishing to access an account held at a banking institution through any one of multiple channels (e.g., at a physical branch, by telephone, or through the Internet) must successfully complete an authorization process before access will be granted. One common authorization technique in the banking industry is a card-and-PIN combination, in which a person wishing to conduct a transaction through a banking machine (e.g., an automated teller machine, or ATM) or with a human teller presents a bank card and enters a PIN (personal identification number) code. If the PIN code entered by the user matches the PIN code encrypted on the card, the authentication process is successful and the user is allowed to access the corresponding accounts and to conduct secure transactions involving those accounts.
Another common, and very simple, authentication technique used for transactions conducted in person at a physical branch is a visual inspection of a government-issued photo-identification document, such as a driver's license or passport. If the person presenting the document appears clearly to be the person depicted on the document, the person is granted access to secure information that is linked to that person or that document.
Certain business establishments allow users to engage in transactions at multiple locations, or touchpoints, within a facility. A banking establishment, for example, typically allows users to engage in business through self-service terminals, such as ATMs, and at full-service teller stations, where the users conduct transactions with the assistance of human tellers. In these establishments, the user must undergo authentication at each of the touchpoints, even when all of the touchpoints are contained within single physical establishment (e.g., a bank building) that is fully controlled by the business establishment. In a banking facility, for example, it is very common for a user to conduct a cash withdrawal through an ATM and then conduct some other transaction (e.g., a check deposit) with the help of a teller. In these situations, the user is typically required to undergo authentication once at the ATM (usually by card-and-PIN) and again at the teller station (usually by card-and-PIN or by photo-identification).